This "case study" is the latest in a series of articles aimed at helping public companies understand how other organizations are using technology to comply with new regulations and standards. These are not advertisements or marketing vehicles for the companies mentioned; Compliance Week's editorial staff speaks with the public company that has deployed the technology, and the article is written without the input—and in many cases the knowledge—of the vendor.

DETAILS

THE COMPANY

Company

FMC Corp.

HQ

Philadelphia

Employees

5,300

Industry

Chemicals

'04 Rev.

$2.1 billion

'04 Net

$160 million

THE CHALLENGE

FMC Corp., a maker of pesticides and other chemicals, needed a software system to document and test its internal controls for Sarbanes-Oxley’s Section 404.

SOLUTION CHOSEN

"Certainty" Sarbanes-Oxley compliance software solution by Cupertino, Calif.-based Movaris.

No System, Really

Diane Manerchia admits she took a somewhat unorthodox approach to managing FMC’s Sarbanes-Oxley Section 404 project.

As she began work in September 2003, the company “had no system, really” to assess internal controls.

Moreover, Manerchia had a bare-bones staff, which included

herself and one compliance manager. As a result, she knew she would need outside help, and she needed it quickly. The effective date for the internal control provisions of SOX was rapidly approaching, and Manerchia needed to identify the company’s risks and controls, test and assess any gaps, remediate them, and then conduct retesting. In addition, she needed to develop a sustainable method of doing these steps, and she had to do it for as little cost as possible.

Oh, and she had to do it all in one year.

FMC began by pursuing two objectives simultaneously. First, one team at the company began looking for a consultant to provide external help; and second, another team began searching for a software tool to automate key processes.

“I know everyone says don’t put a system in until you know what you’re doing,” says Manerchia, “but I was having a hard time figuring out how to accomplish all of this stuff without having some automated tool to do it … I just thought it would not be as easily managed in the course of a year.”

With Certainty

FMC had a few priorities as it looked for a software tool. One was global access. With dozens of offices and plants on every continent, worldwide accessibility to the compliance application was paramount.

Manerchia also required a tool with strong access controls and long-term product support. “Our ability to easily view status of our testing and documentation, the ability to do self-assessments—they were all important for us,” she said.

At the time, FMC had any number of vendors to consider, including those offered by public accounting firms, software upstarts, consulting firms, and enterprise application vendors that had incorporated some internal control modules into existing products and were calling them "Sarbanes-Oxley solutions."

Manerchia drew up a list of 12 possible vendors, and then logically worked through FMC’s needs to develop a process of elimination.

First were the software products from the Big 4 and audit and risk consulting firms like Protiviti. “We looked at all of those," says Manerchia, "but they weren’t in the business of selling software; they’re in the consulting business,” she explained. “I didn’t think that would be a model we could sustain over the long term.”

Manerchia also software solutions from companies like OpenPages and Paisley Consulting. She was impressed with their focus on internal controls, but realized that controls weren't everything. “We thought to ourselves that we already knew about internal controls; I mean, this was nothing new.”

What FMC needed, Manerchia decided, was “a sustainable process that would allow us to quickly assess our execution of these controls. What we felt we really needed to achieve success would be something to help us do it. That’s how we got down to what we really needed was a workflow product, rather than some of the other tools out there.”

That led the company to Movaris’ automated financial controls module, called Certainty. The software helps manage the compliance workflow process by, for example, sending email reminders to employees that guide them through various control procedures on time. The system captures results when completed, and includes automated event-triggers to start control processes when certain non-compliant transactions occur.

Piecemeal Implementation

Because FMC installed the Movaris software as it proceeded through its documentation process, Manerchia says, implementation happened piecemeal around individual processes rather than as one massive IT project. So when asked how long the implementation took, Manerchia balks. “I can’t really talk about it in the context of ‘it took three months’ or anything," she says, "because that’s not how we really did our implementation.”

According to Manerchia, FMC has nine major processes and 60 sub-processes, and roughly 300 key controls built around them. In total, however, the company actually tests or self-assesses about 1,500 controls quarterly, with three questions for each test or self-assessment.

To automate and monitor the processes, Manerchia provided a standard Excel template to process owners so they could provide required documentation. She then shipped the spreadsheets to Movaris, who provided necessary scripting and populated the appropriate data into the Certainty system for FMC.

“The process was pretty easy," says Linda Krikorian, a consultant working on the internal control process at FMC. That's partly because Movaris utilized technology already known and deployed throughout FMC globally. "You’re using Excel,” says Krikorian, and leveraging spreadsheets "is a lot easier than actually manually entering controls.”

Going Fine

Manerchia would not disclose how much FMC paid for the Movaris software, nor would she discuss how much the Section 404 project has cost the company generally.

She does, however, say that the project “is going fine.” About 400 employees use the system worldwide today, and the company has gone through three self-assessments so far.

To those ends, the Movaris system has provided a rapid, effective way to monitor and track compliance across the enterprise. “It makes it very easy to see who is still outstanding, where we stand with all our controls,” says Manerchia. “It’s a very quick way to go around the globe to all these entities, and ensure they’re in compliance with doing what they said they would do in their documentation.”

Manerchia is circumspect when asked how, in hindsight, she might have done things differently. Some of the initial templates and structures might have been designed differently, she admits, but the Movaris software today is much more robust than it was when FMC purchased it in December 2003.

Topics